CyberRota Analysis
AI-GeneratedA vulnerability exists in the Fetch Tool component of the mcp-server-fetch and mcp-server-everything products, specifically in the fetch_url function, which is susceptible to server-side request forgery due to improper handling of URL/path arguments. This flaw can be exploited remotely, potentially allowing attackers to access internal resources or perform unauthorized actions on behalf of the server. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetch_url of the file mcp_server_fetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.